March 2024 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v2 0/6] CVE-2021-47131
by Ziyang Xuan 29 Mar '24

29 Mar '24

Patchset of CVE-2021-47131. v2: - Add fix tag for KABI fix patch. Maxim Mikityanskiy (5): net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up tls: Fix context leak on tls_device_down net/tls: Remove the context from the list in tls_device_down net/tls: Use RCU API to access tls_ctx->netdev Ziyang Xuan (1): net/tls: Resolve KABI break when backport bugfix of CVE-2021-47131 .../mellanox/mlx5/core/en_accel/tls_rxtx.c | 4 +- include/net/tls.h | 21 ++++- net/tls/tls_device.c | 91 +++++++++++++++---- net/tls/tls_device_fallback.c | 9 +- net/tls/tls_main.c | 7 +- 5 files changed, 110 insertions(+), 22 deletions(-) -- 2.25.1

2 7

[PATCH OLK-6.6 00/12] Backport slub performance optimization
by Peng Zhang 29 Mar '24

29 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport mainline slub performance optimization. Chengming Zhou (12): slub: Reflow ___slab_alloc() slub: Change get_partial() interfaces to return slab slub: Keep track of whether slub is on the per-node partial list slub: Prepare __slab_free() for unfrozen partial slab out of node partial list slub: Introduce freeze_slab() slub: Delay freezing of partial slabs slub: Optimize deactivate_slab() slub: Rename all *unfreeze_partials* functions to *put_partials* slub: Update frozen slabs documentations in the source mm/slub: directly load freelist from cpu partial slab in the likely case mm/slub: remove full list manipulation for non-debug slab mm/slub: remove unused parameter in next_freelist_entry() mm/slub.c | 410 ++++++++++++++++++++++++++---------------------------- 1 file changed, 194 insertions(+), 216 deletions(-) -- 2.25.1

2 13

[PATCH OLK-6.6 v3 00/37] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. Catalin Marinas (1): arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio Peter Xu (1): mm/memory: fix missing pte marker for !page on pte zaps Ryan Roberts (2): arm64/mm: Hoist synchronization out of set_ptes() loop arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/arm64/include/asm/mte.h | 4 +- arch/arm64/include/asm/pgtable.h | 58 ++-- arch/arm64/kernel/mte.c | 4 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 421 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 30 files changed, 718 insertions(+), 218 deletions(-) -- 2.27.0

2 38

[PATCH OLK-6.6] arm64: Enable hardware NMI for perf events NMI
by Jinjie Ruan 29 Mar '24

29 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9CQGL -------------------------------- Like pseudo NMI, also select HAVE_PERF_EVENTS_NMI for hardware NMI, and update the comment for arch_perf_nmi_is_available(). Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/Kconfig | 2 +- arch/arm64/kernel/watchdog_hld.c | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 2651809e7f38..a873696d72b3 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -220,7 +220,7 @@ config ARM64 select HAVE_MOD_ARCH_SPECIFIC select HAVE_NMI select HAVE_PERF_EVENTS - select HAVE_PERF_EVENTS_NMI if ARM64_PSEUDO_NMI + select HAVE_PERF_EVENTS_NMI if ARM64_PSEUDO_NMI || ARM64_NMI select HAVE_PERF_REGS select HAVE_PERF_USER_STACK_DUMP select HAVE_PREEMPT_DYNAMIC_KEY diff --git a/arch/arm64/kernel/watchdog_hld.c b/arch/arm64/kernel/watchdog_hld.c index dcd25322127c..817f0b7f6f92 100644 --- a/arch/arm64/kernel/watchdog_hld.c +++ b/arch/arm64/kernel/watchdog_hld.c @@ -28,9 +28,10 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh) bool __init arch_perf_nmi_is_available(void) { /* - * hardlockup_detector_perf_init() will success even if Pseudo-NMI turns off, - * however, the pmu interrupts will act like a normal interrupt instead of - * NMI and the hardlockup detector would be broken. + * hardlockup_detector_perf_init() will success even if Pseudo-NMI or + * Hardware NMI turns off. However, the pmu interrupts will act like + * a normal interrupt instead of NMI and the hardlockup detector would + * be broken. */ return arm_pmu_irq_is_nmi(); } -- 2.34.1

2 1

[PATCH OLK-6.6 v2 00/36] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. Catalin Marinas (1): arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio Ryan Roberts (2): arm64/mm: Hoist synchronization out of set_ptes() loop arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/arm64/include/asm/mte.h | 4 +- arch/arm64/include/asm/pgtable.h | 58 ++-- arch/arm64/kernel/mte.c | 4 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 419 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 30 files changed, 716 insertions(+), 218 deletions(-) -- 2.27.0

2 37

[PATCH OLK-6.6 00/36] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. Catalin Marinas (1): arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio Ryan Roberts (2): arm64/mm: Hoist synchronization out of set_ptes() loop arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/arm64/include/asm/mte.h | 4 +- arch/arm64/include/asm/pgtable.h | 58 ++-- arch/arm64/kernel/mte.c | 4 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 419 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 30 files changed, 716 insertions(+), 218 deletions(-) -- 2.27.0

2 37

[PATCH OLK-6.6 00/33] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 419 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 27 files changed, 676 insertions(+), 192 deletions(-) -- 2.27.0

2 34

[PATCH OLK-6.6 v2 0/6] Introduce dynamic pool feature part 2
by Liu Shixin 29 Mar '24

29 Mar '24

v1->v2: Fix compile error. This part include: 1. Compatible with memory reliable feature[1-3]. 2. Compatible with memory migration[4] 3. Fix an incorrect set of subpool[5]. 4. Make the lock in dynamic pool irq safe[6]. Liu Shixin (6): mm/dynamic_pool: Stop alloc reliable page from dynamic pool mm/mem_reliable: Treat page from dhugetlb pool as unreliable page mm/mem_reliable: Fallback to dpool if reliable memory is not enough mm/dynamic_pool: skip unexpected migration mm/dynamic_pool: don't set subpool for page from dynamic pool mm/dynamic_pool: disable irq for dynamic_pool lock include/linux/dynamic_pool.h | 6 ++ include/linux/mem_reliable.h | 3 + mm/compaction.c | 4 ++ mm/dynamic_pool.c | 112 +++++++++++++++++++---------------- mm/hugetlb.c | 3 +- mm/migrate.c | 7 +++ mm/page_alloc.c | 27 +++++++++ mm/page_isolation.c | 9 ++- 8 files changed, 118 insertions(+), 53 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
by Long Li 29 Mar '24

29 Mar '24

From: Omar Sandoval <osandov(a)fb.com> mainline inclusion from mainline-v6.7-rc5 commit 7081929ab2572920e94d70be3d332e5c9f97095a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV23 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflict: fs/btrfs/ioctl.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 00424d3f3464..178e49bd0060 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -768,6 +768,9 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, int ret; bool snapshot_force_cow = false; + if (btrfs_root_refs(&root->root_item) == 0) + return -ENOENT; + if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) return -EINVAL; -- 2.31.1

2 1

[PATCH OLK-5.10] btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
by Long Li 29 Mar '24

29 Mar '24

From: Omar Sandoval <osandov(a)fb.com> mainline inclusion from mainline-v6.7-rc5 commit 7081929ab2572920e94d70be3d332e5c9f97095a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV23 CVE: CVE-2024-26644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflict: fs/btrfs/ioctl.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 155ce045fabc..28337ebb061c 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -798,6 +798,9 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, struct btrfs_trans_handle *trans; int ret; + if (btrfs_root_refs(&root->root_item) == 0) + return -ENOENT; + if (!test_bit(BTRFS_ROOT_SHAREABLE, &root->state)) return -EINVAL; -- 2.31.1

2 1